[roomote-roomote]

​Created by Roomote. View the session or mention @roomote-roomote for follow-up asks.

Related issue

Addresses Dependabot alert #301, the high-severity body-parser compressed-body denial of service (GHSA-27r3-jxmh-p828). Partial result: the six requested authentication alerts #310–#315 remain unresolved, as explained below. No alerts were dismissed; GitHub closure of #301 awaits merge and dependency rescan.

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

Apply the independently safe parser security patch without introducing the confirmed sign-in regressions encountered in the authentication upgrade. Live alerts and open PR coverage were rechecked; existing dependency PRs #3600 and #3625 do not remediate this parser alert.

What changed

• Update the existing body-parser override and workspace resolution 2.3.0 → 2.4.0, with required content-type 2.1.0 and iconv-lite 0.7.3 resolutions. The actual runtime dependency path is API → MCP SDK → Express → body-parser.
• Generate the lockfile with pnpm. Its two existing Vitest/OpenTelemetry peer-context references are relinked by the resolver; neither Vitest nor OpenTelemetry gains a new package version. The standalone API runtime lockfile contains none of the targeted parser/authentication packages and needs no change.
• Preserve minimumReleaseAge: 10080 and all exclusions byte-for-byte. All three new resolutions exceed seven days; body-parser 2.4.0 was published October 22, 2026 at 11:39:38 UTC and became eligible October 29. Release notes confirm the security fix, parser-option handling changes, and added Zstandard support.

There is no intended user-visible behavior change from the delivered parser update.

Authentication bundle deferred: compatibility migration required

An aligned Better Auth/core/adapter 1.7.12 attempt passed the existing web server tests but failed web typechecking: genericOAuthClient is removed, and Slack's callback-valued authorizationUrlParams is unsupported. Upstream 1.7.7 and 1.7.12 use social sign-in/linking endpoints and /callback/:id, while Roomote's client and registered provider redirects use the old OAuth2 endpoints. The Microsoft helper also changes existing linked-account identity from sub to oid and rejects formerly supported non-GUID tenants. An import-only repair would leave real authentication broken.

The attempted authentication edits were fully reverted. Critical alert #311, high alerts #310/#312, and low alerts #313/#314/#315 remain open and uncovered. They need a behavior-preserving OAuth/client/callback/account-identity migration with real upgraded-library regression coverage. Release age is not blocking authentication. Compatibility assessment and next remediation.

How it was tested

Final parser-only graph, Node 24.22.1 / pnpm 10.29.3:

• Frozen full-workspace install, including a forced clean refresh, passes. Both lockfiles contain no vulnerable body-parser resolution. Registry publication checks confirm all three new versions satisfy the unchanged age policy. Replayable graph/age check.
• A real ephemeral HTTP listener created by the installed MCP SDK's Express helper resolves body-parser 2.4.0 and successfully parses ordinary uncompressed, gzip, deflate and Brotli JSON. Normal form parsing and malformed-JSON HTTP 400 also pass. No exploit reproduction or external service was used. Replayable runtime smoke; run from the repository root.
• API MCP suite: 50 files / 1,004 tests passed. Final auth/client/session regression selection: 6 files / 62 tests passed, including real Better Auth/Next cookie/PostgreSQL session renewal, expiry, deletion and logout. These retain the original authentication dependency version; they do not establish remediation of the deferred authentication alerts.
• API production build, normal broad fast lint/typechecks, Knip, and unmodified pre-commit/pre-push hooks pass. The pre-existing Dayton/AWS peer warning and non-blocking Mintlify Knip hint remain.
• Browser proof is not applicable to the final backend parser-only change: the real SDK HTTP harness proves the parsing behavior; screenshots would not. No screenshot or external-provider OAuth verification is claimed. Full repository tests, web production build, and formatting-inclusive lint/type aliases were not run on the final graph.

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally
  • Normal broad fast equivalents passed; formatting-inclusive aliases were not run.
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset
  • No changeset for this narrow transitive security patch.

[roomote-community]

No code issues found. See session

Reviewed the override, all lockfile changes, MCP SDK → Express dependency resolution, upstream parser requirements and security fix, and unchanged release-age policy. Both relinked Vitest peer contexts exist. The deferred authentication alerts are outside this parser-only diff.

Current-head CI lint, typecheck, Knip, upgrade compatibility, and CodeQL checks passed; tests and the app image build were still running when checked. Repository validation suites were not rerun during review.

_{Reviewed 5ec9b4b}